plutonium 0.66.0 → 0.67.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b131f7d0e5b02982f4696e7d1db781f45b17f8b28f17da5fe5cc3b0a4480c7a0
-  data.tar.gz: f700d3d65a3fc368e73315c436a7f8d2afb5244cd04b4b0be5618efbc738d26f
+  metadata.gz: 7285167839fdb5e60e89da076028dc08b719ec60125cb61faaeb26cd151b9140
+  data.tar.gz: 87fe956c9ab3cdcc92e7083a3c5c965c144661f530e4ce0cb609d3b0a8adfb06
 SHA512:
-  metadata.gz: 7dc926b3cf2fb69f5dfa4644d10c47e88a39e74f3359be2572a4ea6ea46ad216a5c0447959b0e1596f0ee6ae67190140f46acc53afa332a508e63f275440bdad
-  data.tar.gz: 4d9f3fba2b94d24ef0db3d5b24b35b30d6c058acc46ac20107d37c1a507f804dac7d47b3a38556f02b16ac229ce9b2a4140e73216152c9e56ae7189a5c71bc00
+  metadata.gz: 3cdc13417311bd847b8b721ae46da0b59b12ecb1fafe95be087e556d71ac4d053d236169f2d48fa08edf831f9d49cdfdce27c3e28229b1bf5155dafdfb30cad5
+  data.tar.gz: 539932b5d8700edf4878fde1eb3c33ed0cd518d6ebafbbcf83df92de5ff098061dabcc1c1ca1a859cdfcf1e68a3f3e6ceaa55c44499b4132f132192db5cfcd18

data/.claude/skills/plutonium-resource/SKILL.md

@@ -543,19 +543,20 @@ The field-level help keys (`:label`, `:description`, `:hint`, `:placeholder`) ar
 
 | Category | Types |
 |----------|-------|
-| Text | `:string`, `:text`, `:email`, `:url`, `:tel`, `:password` |
-| Rich Text | `:markdown` (EasyMDE) |
-| Numeric | `:number`, `:integer`, `:decimal`, `:range` |
+| Text | `:string`, `:text`, `:email`, `:url`, `:phone`, `:password` (alias `:secret`) |
+| Rich Text | `:rich_text` (Action Text editor: Trix, or Lexxy once installed; **default** for `has_rich_text`), `:markdown` (EasyMDE) |
+| Numeric | `:number`, `:integer`, `:decimal`, `:range`, `:rating` (star picker, `max:`) |
 | Boolean | `:toggle` / `:switch` (switch, **default** for boolean columns), `:boolean` (plain checkbox) |
 | Date/Time | `:date`, `:time`, `:datetime` |
-| Selection | `:select`, `:slim_select`, `:radio_buttons`, `:check_boxes` |
-| Files | `:file`, `:uppy`, `:attachment` |
+| Selection | `:select`, `:slim_select`, `:collection_radio_buttons`, `:collection_checkboxes` |
+| Lists | `:list` (chip input for array values; `suggestions:`, `addable:`, `limit:`), `:tags` (no_fly_list `has_tags` contexts, **auto-detected**) |
+| Files | `:file`, `:uppy`, `:attachment` (Active Storage), `:binary` (bytes in a `binary` column) |
 | Associations | `:association`, `:secure_association`, `:belongs_to`, `:has_many`, `:has_one` |
-| Special | `:hidden`, `:color`, `:phone` |
+| Special | `:hidden`, `:color`, `:json`, `:key_value` |
 
 ### Display Types (show / index)
 
-`:string`, `:text`, `:email`, `:url`, `:phone`, `:markdown`, `:number`, `:integer`, `:decimal`, `:boolean`, `:badge`, `:currency`, `:color`, `:date`, `:time`, `:datetime`, `:association`, `:attachment`
+`:string`, `:text`, `:email`, `:url`, `:phone`, `:markdown`, `:number`, `:integer`, `:decimal`, `:boolean`, `:badge`, `:currency`, `:color`, `:date`, `:time`, `:datetime`, `:association`, `:attachment`, `:key_value`, `:binary`, `:list`, `:tags`, `:rich_text`, `:relative_time`, `:code`, `:duration`, `:file_size`, `:progress`, `:rating`
 
 #### Auto-inferred display formatting
 
@@ -565,7 +566,10 @@ These render automatically: declare an `as:` only to override or pass options:
 |--------|-----------|-------|
 | `boolean` | Yes/No pill (`:boolean`) | green "Yes" / neutral "No". Override labels: `true_label:`, `false_label:` |
 | `enum` | colored status badge (`:badge`) | known statuses (active, pending, failed…) auto-colored; unknown values get a stable decorative color |
-| `has_cents` decimal | currency (`:currency`) | delimited, 2 decimals, **no symbol** unless you add `unit:` |
+| `binary` | size (`:binary`) | `Binary data (12 KB)`, never the bytes |
+| `has_rich_text` | HTML (`:rich_text`) | rendered and sanitized by Action Text |
+| no_fly_list `has_tags` | chips (`:tags`) | declare by context name (`:labels`), not `labels_list` |
+| `has_cents` decimal | currency (`:currency`) | delimited, 2 decimals; symbol from `unit:` (display or `has_cents`), else `config.default_currency_unit` / i18n. `unit: false` drops it |
 
 ```ruby
 display :status, as: :badge, colors: {archived: :neutral, vip: :accent}  # override per-value color
@@ -1277,6 +1281,7 @@ end
 | Date Range | `:date_range` | `from`, `to` | `from_label:`, `to_label:` |
 | Select | `:select` | `value` | `choices:`, `multiple:` |
 | Association | `:association` | `value` | `class_name:`, `multiple:` |
+| Tags | `:tags` | `value` | `match:` (`:any` default, `:all`); no_fly_list contexts, options limited to the policy scope |
 
 **Text predicates:** `:eq`, `:not_eq`, `:contains`, `:not_contains`, `:starts_with`, `:ends_with`, `:matches`, `:not_matches`
 **Date predicates:** `:eq`, `:not_eq`, `:lt`, `:lteq`, `:gt`, `:gteq`
@@ -1291,6 +1296,7 @@ filter :category,     with: :select,      choices: -> { Category.pluck(:name) }
 filter :tags,         with: :select,      choices: %w[ruby rails js], multiple: true
 filter :category,     with: :association
 filter :author,       with: :association, class_name: User
+filter :labels,       with: :tags                          # no_fly_list context
 ```
 
 **Custom filter class:**

data/.claude/skills/plutonium-ui/SKILL.md

@@ -309,7 +309,7 @@ render field(:title).wrapped(class: "col-span-full") { |f| f.input_tag }
 | Tag | Input |
 |---|---|
 | `input_tag` | text (auto-detected type) |
-| `string_tag`, `text_tag`, `number_tag`, `email_tag`, `password_tag`, `url_tag`, `tel_tag`, `hidden_tag` | standard HTML inputs |
+| `string_tag`, `text_tag`, `number_tag`, `email_tag`, `password_tag` / `secret_tag`, `url_tag`, `hidden_tag` | standard HTML inputs |
 | `checkbox_tag`, `select_tag`, `radio_button_tag` | standard |
 | `toggle_tag` / `switch_tag` | switch-styled boolean (`as: :toggle` / `:switch`), default for boolean columns; `as: :boolean` for a plain checkbox |
 
@@ -325,6 +325,13 @@ render field(:title).wrapped(class: "col-span-full") { |f| f.input_tag }
 | `secure_association_tag` | Association with policy-checked options |
 | `belongs_to_tag` / `has_many_tag` / `has_one_tag` | Association selects |
 | `key_value_store_tag` | Key/value pairs editor |
+| `currency_tag` | Money input (number field + unit prefix) |
+| `rich_text_tag` | Action Text editor (Trix, or Lexxy once the app installs it); default for `has_rich_text` |
+| `list_tag` | Chip input for array values (`suggestions:`, `limit:`, `addable: false`) |
+| `tags_tag` | Chip input for a no_fly_list `has_tags` context; default for those contexts |
+| `rating_tag` | Star picker (`max:`, default 5); a Clear option unless required |
+| `binary_tag` | Plain file input whose bytes go into a `binary` column |
+| `json_tag` | JSON editor; default for `json`/`jsonb` columns |
 
 ```ruby
 render field(:published_at).wrapped { |f| f.flatpickr_tag(min_date: Date.today, enable_time: true) }
@@ -335,11 +342,12 @@ render field(:avatar).wrapped       { |f| f.uppy_tag(allowed_file_types: %w[.jpg
 
 `password_tag` masks the stored value and **never emits the secret into the DOM**. A stored secret renders a sentinel; an untouched submit keeps it, an edit-to-new-value then failed re-render comes back blank + `required` (re-type; secrets are never echoed back), a *cleared* field comes back blank but **not** `required` (the clear may be intentional), a deliberately emptied field clears it (clear-by-blank), a typed value sets it. The sentinel is guarded by the `password-sentinel` Stimulus controller: the first edit (incl. **backspace**) wipes the whole field so a partial edit can't corrupt it.
 
-Auto-detected by name: `password`/`token`/`salt`, `encrypted_*`, `*_password`/`*_digest`/`*_hash`/`*_token`/`*_key`/`*_salt`, or any name containing `secret`. A convenience, **not** a guarantee: odd-named secrets (`recovery_phrase`, `pin`) still leak unless masked explicitly.
+Auto-detected by name: `password`/`token`/`salt`, `encrypted_*`, `*_password`/`*_digest`/`*_hash`/`*_token`/`*_key`/`*_salt`, or any name containing `secret`. The same names render `••••••••` on the show page, table, wizard summary and grid/kanban cards; `field`/`display` `as:` overrides it there too. A convenience, **not** a guarantee: odd-named secrets (`recovery_phrase`, `pin`) still leak unless masked explicitly.
 
 ```ruby
 field :api_token,   as: :string     # opt OUT: show a readable value (token to copy, checksum)
 field :recovery_phrase, as: :password   # opt IN: mask a secret the heuristic misses
+field :pin, as: :secret                 # :secret is an alias of :password
 ```
 
 ## Submit buttons
@@ -1114,7 +1122,7 @@ end
 
 ### Display theme keys
 
-`fields_wrapper`, `fields_inner`, `sections_wrapper`, `section_grid`, `label`, `description`, `string`, `text`, `link`, `email`, `phone`, `markdown`, `json`, `boolean`, `badge`, `currency`, `color`.
+`fields_wrapper`, `fields_inner`, `sections_wrapper`, `section_grid`, `label`, `description`, `string`, `text`, `link`, `email`, `phone`, `markdown`, `rich_text`, `json`, `key_value`, `list` / `list_item`, `boolean`, `badge`, `currency`, `color`, `binary`, `relative_time`, `code`, `duration`, `file_size`, `progress`, `rating`. Table cells use `Plutonium::UI::Table::DisplayTheme`, which has its own (more compact) entry for each.
 
 ⚠️ **`fields_wrapper` is the CARD, `fields_inner` is the grid.** `fields_wrapper` is merged into a `Plutonium::UI::Block` (which supplies `pu-card` itself), so putting grid classes there styles the card, not the fields. Override `fields_inner` to change the unsectioned grid, and `section_grid` to change the grid inside a `display_layout` section.
 

data/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.67.0] - 2026-10-09
+
+### Bug Fixes
+
+- Keep view switcher from clipping on narrow screens
+- Restore CSRF verification for cookie sessions ([#175](https://github.com/radioactive-labs/plutonium-core/issues/175))
+- Let slim-select dropdown overflow modal edge instead of clipping
+- Load Font Awesome 4.7 from jsdelivr for EasyMDE toolbar icons
+- Mask secret fields on every display surface
+- Fixes from the component audit
+
+### Features
+
+- Binary column input and display
+- Key/value, list, rating and value display components
+- No_fly_list tags support
+- [**breaking**] Render has_rich_text through Action Text's editor
+
+### Testing
+
+- Search slim-select typeaheads by email in system tests ([#177](https://github.com/radioactive-labs/plutonium-core/issues/177))
+
 ## [0.66.0] - 2026-10-08
 
 ### Bug Fixes

data/SECURITY.md

@@ -12,7 +12,7 @@ please upgrade before reporting an issue to confirm it still reproduces.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| Latest release (`0.66.x`) | :white_check_mark: |
+| Latest release (`0.67.x`) | :white_check_mark: |
 | Older releases | :x: |
 
 ## Reporting a Vulnerability